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We present and demonstrate a new protocol for practical quantum cryptography, tailored for an 
implementation with weak coherent pulses to obtain a high key generation rate. The key is obtained 
by a simple time-of-arrival measurement on the data line; the presence of an eavesdropper is checked 
by an interferometer on an additional monitoring line. The setup is experimentally simple; moreover, 
it is tolerant to reduced interference visibility and to photon number splitting attacks, thus featuring 
a high efficiency in terms of distilled secret bit per qubit. 
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Quantum key distribution (QKD) is the only method 
to distribute a secret key between two distant authorized 
partners, Alice and Bob, whose security is based on the 
laws of physics Q. QKD is the most mature field in 
quantum information; nevertheless, there is still some 
work ahead in order to build a practical system which 
is reliable and at a same time fast and provably secure. 
This paper presents an important improvement in this 
direction. The quest for rapidity is the inspiring motiva- 
tion of this system: the idea is to obtain the secret bits 
from the simplest possible measurement (here, the time 
of arrival of a pulse) without introducing lossy optical 
elements at Bob's. Security is obtained by occasionally 
checking quantum coherence: in QKD, a decrease of co- 
herence is attributed to the presence of the eavesdropper 
Eve, who has attacked the line and obtained some in- 
formation on the bit values, at the price of introducing 
errors. Reliability is achieved by using standard telecom 
components; in particular, the source is an attenuated 
laser, and bits are encoded in time-bins, robust against 
polarization effects in fibers. In this paper, we first define 
the protocol and demonstrate its advantages: simplicity, 
and robustness against both reduced interference visibil- 
ity and photon number splitting (PNS) attacks ,2|. Then, 
we present a first proof-of- principle experiment. 

The protocol. To date, the most developed setups 
for practical QKD implement the Bennett-Brassard 1984 
(BB84) protocol [3| using phase encoding between two 
time-bins, as sketched in Fig.QjTop (see [l| for a detailed 
description). The four states belonging to two mutually 
orthogonal bases are the |1)|0) + e ia |0)|l) where a = 0, it 
(bits and 1 in the X basis) or a = i,y (bits and 
1 in the Y basis). Bob detects in the X (Y) basis by 
setting /3 = (/? = § ). Both bases correspond thus to 
an interferometric measurement. As a first step towards 
simplicity, we replace (say) the Y basis with the Z basis 
{|1)|0), |0)|1)}. Measuring in this basis amounts simply 
to the measurement of a time of arrival, and is thus in- 
sensitive to optical errors Q. Bits are encoded in the Z 
basis, which can be used most of the times, the X basis 
being used only occasionally to check coherence . 

In a practical QKD setup, the source is an attenuated 
laser: here, Alice's source consists of a cw laser followed 
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FIG. 1: Comparison of the currently implemented BB84 pro- 
tocol with phase encoding (Top) with the scheme proposed 
here (Bottom). Arrows over pulses indicate coherence (phase 
set to in our scheme). See text for details. 



by an intensity modulator (IM), which either prepares a 
pulse of mean photon-number [i or blocks completely the 
beam (empty or "vacuum" pulses) 0. The fc-th logical 
bit is encoded in the two-pulse sequences consisting of a 
non-empty and an empty pulse: 



1°*) = |VM>2 fe -ll >2 fc . 

Ilk) = |0>2fc-i|VM> 2fe - 



(1) 
(2) 



Note that |0fc) and |lfc) are not orthogonal, due to their 
vacuum component; however, a time-of-arrival measure- 
ment, whenever conclusive, provides the optimal unam- 
biguous determination of the bit value . To check co- 
herence, we produce a fraction / <C 1 of decoy sequences 
| v //l) 2fe _ 1 |y / 7*) 2 fe! while for BB84, one should produce 

the two states 



Now, due to 

the coherence of the laser, there is a well-defined phase 
between any two non-empty pulses: within each decoy 
sequence, but also across the bit- separation in the case 
where bit number k is 1 and bit number k + 1 is (a " 1-0 
bit sequence"). Since we produce equally-spaced pulses, 
the coherence of both decoy and 1-0 bit sequences can 
be checked with a single interferometer (see Fig. ^ Bot- 
tom). And there is a further benefit: coherence being 



2 



distributed both within and across the bit separations, 
Eve cannot count the number of photons in any finite 
number of pulses without introducing errors Q : in our 
scheme the PNS attacks can be detected @. To detect 
PNS attacks in BB84, one needs to complicate the pro- 
tocol by the technique of decoy states, which consists in 
varying \x 0. 

The pulses propagate to Bob on a quantum channel 
characterized by a transmission t, and are split at a 
non-equilibrated beam-splitter with transmission coeffi- 
cient ts 1. The pulses that are transmitted (data 
line) are used to establish the raw key by measuring 
the arrival times of the photons. The counting rate is 
R = 1 — e~ Altt - B?? « fittBT], where rj is the quantum ef- 
ficiency of the photon counter. The pulses that are re- 
flected at Bob's beam-splitter go to the interferometer 
that is used to check quantum coherence (monitoring 
line). Indeed, when both pulses j and j + 1 are non- 
empty, then only detector Dmi can fire at time j + 1. 
Coherence can be quantified by Alice and Bob through 
the visibility of the interference 

v = p(Dmi)-p(Dm2) 
p(Dmi) +p{D M 2) 

where p(DMj ) is the probability that detector Dmj fired 
at a time where only Dmi should have fired. These prob- 
abilities are small, the average detection rate on the mon- 
itoring line being \[it (1 — tB)r\ per pulse. Still, ifthebit 
rate is high, meaningful estimates can be done in a rea- 
sonable time. 

Let's summarize the protocol: 

1. Alice sends a large number of times "bit 0" with 
probability ^-$r-, "bit 1" with probability and 
the decoy sequence with probability /. 

2. At the end of the exchange, Bob reveals for which 
bits he obtained detections in the data line and 
when detector D%m has fired. 

3. Alice tells Bob which bits he has to remove from his 
raw key, since they are due to detections of decoy 
sequences (sifting). 

4. Analyzing the detections in Dim Alice estimates 
the break of coherence through the visibilities Vj_o 
and Vd associated respectively to 1-0 bit sequences 
and to decoy sequences, and computes Eve's infor- 
mation. 

5. Finally, Alice and Bob run error correction and pri- 
vacy amplification and end up with a secret key. 

Estimate of the secret key rate. The performance of a 
QKD protocol is quantified by the achievable secret key 
rate R s k- To compute this quantity, we need to intro- 
duce several parameters. The fraction of bits kept after 
sifting (sifted key rate) is R s (n) — [R + 2pd{l — R)]p s 



with R = uttBT) the counting rate due to photons defined 
above, pd the probability of a dark count, and p s = 1 — / 
here. The amount of errors in the sifted key is called 
quantum bit error rate (QBER, Q). Moreover, this key 
is not secret: Eve knows a fraction I Eve of it. Some clas- 
sical postprocessing (error correction and privacy ampli- 
fication) allows to extract a key which is errorless and 
secret, while removing a fraction h(Q) + 1 Eva where h is 
binary entropy. Thence, 

R sk = R.(p)(l-h(Q)-lEve). (4) 

With this figure of merit, we can compare our scheme 
to BB84 implemented using the interferometric bases X 
and Y, as it is done today, with an asymmetric use of 
the bases such that p s = 1 — / (BB84xy). We require 
that all the visibilities are equal: Vx = Vy in BB84xy, 
Vi-q = Vd in our scheme — otherwise, Alice and Bob 
abort the protocol. Under this assumption, the QBER of 
BB84 is Q(fi) = [R^f + (l-R) Pd ]p s /R s = Q opt +Q det ; 
while in our scheme Q(n) = Qdet, independent of V. 

In order to estimate I Eve, we restrict the class of Eve's 
attacks |(|, waiting for a full security analysis. Because 
of losses and the existence of multi-photon pulses, Eve 
can gain full information on a fraction of the bits without 
introducing any errors. This fraction is either r = ji(l—t) 
or r = 7^, according to whether PNS attacks don't or do 
introduce errors . Then Eve performs the intercept- 
resend attack on a fraction pm of the remaining pulses. 
In BB84xf, she introduces the error (1 — r)p/R \ = ^-ir~ 
and gains the information I = (1 — r)pmh = 1 — V. 
On the present protocol, the IR will be performed in the 
time basis, so I = (1 — r)pjp>. However, since we use 
only one decoy sequence, if Eve detects a photon in two 
successive pulses she knows what sequence to prepare; 
the introduced error is thence 1— V = I£ with £ = ^te-^ 
the probability that Eve detects something in one pulse 
and nothing in the other. Plugging Q(fi) and Ievc = r+I 
into Eq. |@J, we have R s k as an explicit function of fj,; 
Alice and Bob must choose /1 in order to maximize it. 
The result of numerical optimization is shown in Fig. |3 
fiof. As expected, the present protocol is more robust 
than BB84xy against the decrease of visibility. 

Proof- of -principle experiment. We show that a reason- 
ably low QBER and good visibility can be obtained us- 
ing standard telecom components in an implementation 
with optical fibers. The experimental setup is sketched 
in Fig. |3J The light of a cw laser (wavelength 1550 nm) 
passes through a intensity modulator (IM), which pre- 
pares the chosen pulse sequence. For simplicity, we send 
always the same 8-pulse sequence as shown in the figure, 
namely the string D010, where D stands for a decoy se- 
quence. The frequency of 434 MHz of clock C\ defines 
the time r between two successive pulses. The frequency 
of logical bits in a sequence is half of this frequency. The 
clock C2 at 600 kHz generates the delay between two 
successive sequences. After the modulator, the light is 
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FIG. 2: Estimate of the secret key rates Eq. for the present 
protocol and for BB84xy with and without decoy states, as a 
function of the losses on the line I (t — 10~ e ^ 10 ). Parameters: 
■q = 10%, Vd = 10~ 5 , t B = 1 and / = 0.1. Visibility: V = 
1 (full lines, identical for the two first protocols), V = 0.9 
(dashed lines) and V = 0.8 (dotted lines; R sk = for BB84 
without decoy states) . 



attenuated by the variable attenuator (VA) in order to 
obtain fi = 0.5 for 5 dB loss in the quantum channel 
|lfj| . The synchronization signal directly starts the time- 
to-digital converter (TDC) and triggers the detectors on 
Bob's side. The detectors Db (data line) and Dm (mon- 
itoring line) are opened with gates of 25 ns accepting the 
whole sequence, featuring quantum efficiency r\ = 10% 
and a dark count probability pd = 2.5 x 10~ 5 per ns. Of 
course, due to the deadtime of the detectors, only one 
event per sequence and detector can be detected. The 
stop signal from Dm arm is delayed, which allows to 
record the events of both detectors by the same TDC. 
The Michelson interferometer of the monitoring line has 
the same path length difference r (46 cm of optical fibre) 
corresponding to the clock frequency. It is enclosed in an 
insulated, temperature controlled box (IB). The phase 
can be changed by changing the temperature. The inter- 
ferometer (hence our entire setup) is polarization insensi- 
tive due to Faraday mirrors (FM) and features a classical 
fringe visibility of 99%. 

The raw detection rate is of 17.0±0.1 kHz. The de- 
tection rate is limited by the detectors, due to the 10 
/is deadtime we have to introduce in order to limit af- 
tcrpulses. With current detectors, the potential of an 
improved setup continuously sending pulses at C%, with 
optimized values for /i, / and ts could only be exploited 
at long distances. Otherwise, one could use a detection 
system based on up-conversion and fast thin silicon de- 
tector [m. 

The QBER for the pulse sequences '10' and '01' is ob- 
tained by considering the time windows of 1.7 ns as in- 
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FIG. 3: Experimental setup (see text for details). 



dicated in Fig. H The value is Q = 5.2 ± 0.4%. The 
contribution of detector noise and afterpulses (which are 
rather high for the long gates and high repetition rates 
we are using) is estimated to be 4%; we attribute the 
remaining 1% to unperfect intensity modulation, mainly 
due to too slow electronics and to the jitter of the detec- 
tors. 

The visibility of the interfering pulses on detector Dm 
is measured by varying the phase (i.e the temperature) 
of the interferometer. The raw visibility is V raw > 92%, 
if we consider 1.7 ns time windows. The net visibil- 
ity, obtained deducing the dark counts and afterpulses 
is V « 98%. We attribute the slight reduction of the vis- 
ibility to a non perfect overlap of the interfering pulses 
due to timing jitter and fluctuations in the intensity mod- 
ulation. However, this reduced visibility has no signifi- 
cant consequence on the secret key rate (Fig. 0). This 
tolerance in visibility simplifies the adjustment of the in- 
terferometers. With our basic thermal stabilization the 
interferometer needed to be readjusted only about every 
30 minutes. Indeed, for our path length difference, a tem- 
perature stability of 0.01 K guarantees V > 80%. Note, 
the higher C\ , the easier becomes the stabilization of the 
interferometer. 

Conclusion. We have introduced a new scheme for 
QKD and presented first experimental results. The 
scheme features several advantages: The data line is very 
simple, with low losses at Bob's side and small optical 
QBER. The scheme is tolerant against reduced interfer- 
ence visibility and is robust against PNS attacks (thus 
allowing the mean photon number to be large, typically 
fi ~ 0.5). Finally, it is polarization insensitive. The ex- 
istence of such a scheme shows that the main limiting 
parameter for practical quantum cryptography are the 
imperfections of the detectors. 
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modulator. 
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FIG. 4: Detection as a function of the difference of time be- 
tween start and detection. Logical values and pulse values are 
depicted in more of the measurement. The difference of am- 
plitude of the different peaks is due to variation in efficiency 
in the detection gate. 
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